Cookie Policy
We use a small number of strictly necessary cookies so the create form can run securely. We do not run advertising or analytics cookies.
Last updated: 18 September 2026
1. What we use
Roast Lab only uses cookies that are needed to operate the create form securely. Roast share pages do not need a cookie to open. This approach is intended to stay within the “strictly necessary” category under the Privacy and Electronic Communications Regulations 2003 (PECR).
2. Session cookie
When you open the homepage we may set a first-party session cookie named __Host-Session. It is:
- first-party only
- Secure
- HttpOnly
- SameSite=Strict
It holds session state including a CSRF token so the create form cannot be submitted from another site in a simple cross-site request forgery attack. It expires when you close the browser (session lifetime). Lawful basis under PECR: strictly necessary to provide the service you requested.
3. What we do not use
- advertising or retargeting cookies
- analytics or heat-map cookies
- social-media tracking pixels on Roast Lab pages
- third-party marketing cookies
If you share a roast URL on another platform, that platform may set its own cookies under its own policies. That is outside Roast Lab.
4. How to control cookies
You can block or delete cookies in your browser settings. If you block the session cookie, the create form will not submit reliably. Share links you already have will still open until they expire or are removed.
5. More information
Personal data processed alongside cookies is described in our Privacy Policy. Questions: hello@roastlab.co.uk.